XSS in send_resp

This submodule looks for XSS vulnerabilities in the body argument of Conn.send_resp.

A known data content type on the response connection suppresses the finding. Both put_resp_content_type and put_resp_header with the literal "content-type" header are recognized. HTML and SVG retain their confidence; dynamic, malformed, and other scriptable document types remain low-confidence findings. PDF and XML document findings are suppressed when the same connection has a recognized literal content-disposition: attachment header before the response. HTML and SVG still report. Dynamic, malformed, duplicate-parameter, and unsupported extended disposition values do not prove a download context.

SendResp checks can be ignored with the following command:

$ mix sobelow -i XSS.SendResp